部署etcd集群

Posted kevin_ying

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了部署etcd集群相关的知识,希望对你有一定的参考价值。

1、集群规划

服务器名称 服务地址 角色
YN101-22.host.com 192.168.101.22 etcd leader
YN101-31.host.com 192.168.101.31 etcd follow
YN101-32.host.com 192.168.101.32 etcd follow

2、创建基于根证书的config配置文件YN101-100.host.com主机操作

cd /opt/certs/
vi ca-config.json
{
  "signing": {
    "default": {
      "expiry": "175200h"
    },
    "profiles": {
      "server": {
        "expiry": "175200h",
        "usages": [
          "signing",
          "key encipherment",
          "server auth"
        ]
      },
      "client": {
        "expiry": "175200h",
        "usages": [
          "signing",
          "key encipherment",
          "server auth"
        ]
      },
      "peer": {
        "expiry": "175200h",
        "usages": [
          "signing",
          "key encipherment",
          "server auth"
        ]
      }
    }
  }
}
vi etcd-peer-csr.json
{
  "CN": "k8s-etcd",
  "hosts": [
    "192.168.101.21",
    "192.168.101.22",
    "192.168.101.31",
    "192.168.101.32"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "YN",
      "L": "KM",
      "O": "kevin",
      "OU": "edu"
    }
  ]
}
#生成etcd证书和私钥
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=peer etcd-peer-csr.json |cfssl-json -bare etcd-peer
#生成证书如下
[root@yn101-100 certs]# ll
total 36
-rw-r--r-- 1 root root  610 Feb 17 22:54 ca-config.json
-rw-r--r-- 1 root root  985 Feb 16 12:53 ca.csr
-rw-r--r-- 1 root root  189 Feb 16 12:53 ca-csr.json
-rw------- 1 root root 1679 Feb 16 12:53 ca-key.pem
-rw-r--r-- 1 root root 1322 Feb 16 12:53 ca.pem
-rw-r--r-- 1 root root 1054 Feb 17 22:56 etcd-peer.csr
-rw-r--r-- 1 root root  300 Feb 17 22:37 etcd-peer-csr.json
-rw------- 1 root root 1679 Feb 17 22:56 etcd-peer-key.pem
-rw-r--r-- 1 root root 1395 Feb 17 22:56 etcd-peer.pem

3、YN101-22.host.com主机操作

给etcd创建一个用户

useradd -s /sbin/nologin -M etcd
[root@yn101-22 src]# id etcd
uid=1000(etcd) gid=1000(etcd) groups=1000(etcd)
#etcd下载地址,本机安装3.1.20版本
https://github.com/etcd-io/etcd/releases/tag/v3.1.20
#解压
cd /opt/src
tar xfv etcd-v3.1.20-linux-amd64.tar.gz -C /opt/
mv etcd-v3.1.20-linux-amd64/ etcd-v3.1.20
#软连接
[root@yn101-22 opt]# ln -s /opt/etcd-v3.1.20/ /opt/etcd
[root@yn101-22 opt]# ll
total 0
lrwxrwxrwx 1 root   root   18 Feb 17 23:05 etcd -> /opt/etcd-v3.1.20/
drwxr-xr-x 3 478493 89939 123 Oct 11  2018 etcd-v3.1.20
drwxr-xr-x 2 root   root   45 Feb 17 22:19 src
#创建目录,拷贝证书和私钥
mkdir -p /opt/etcd/certs /data/etcd /data/logs/etcd-server
scp yn101-100:/opt/certs/ca.pem .
scp yn101-100:/opt/certs/etcd-peer.pem .
scp yn101-100:/opt/certs/etcd-peer-key.pem .

创建etcd的启动脚本 vi /opt/etcd/etcd-server-startup.sh

#!/bin/sh
./etcd --name etcd-server-101-22         --data-dir /data/etcd/etcd-server         --listen-peer-urls https://192.168.101.22:2380         --listen-client-urls https://192.168.101.22:2379,http://127.0.0.1:2379         --quota-backend-bytes 8000000000         --initial-advertise-peer-urls https://192.168.101.22:2380         --advertise-client-urls https://192.168.101.22:2379,http://127.0.0.1:2379         --initial-cluster etcd-server-101-22=https://192.168.101.22:2380,etcd-server-101-31=https://192.168.101.31:2380,etcd-server-101-32=https://192.168.101.32:2380         --ca-file ./certs/ca.pem         --cert-file ./certs/etcd-peer.pem         --key-file ./certs/etcd-peer-key.pem         --client-cert-auth         --trusted-ca-file ./certs/ca.pem         --peer-ca-file ./certs/ca.pem         --peer-cert-file ./certs/etcd-peer.pem         --peer-key-file ./certs/etcd-peer-key.pem         --peer-client-cert-auth         --peer-trusted-ca-file ./certs/ca.pem         --log-output stdout
chmod +x etcd-server-startup.sh
chown -R etcd.etcd /opt/etcd-v3.1.20/
#更改后输出如下,文件为etcd用户
[root@yn101-22 etcd]# ll
total 30072
drwxr-xr-x  2 etcd etcd       66 Feb 17 23:12 certs
drwxr-xr-x 11 etcd etcd     4096 Oct 11  2018 Documentation
-rwxr-xr-x  1 etcd etcd 16406432 Oct 11  2018 etcd
-rwxr-xr-x  1 etcd etcd 14327712 Oct 11  2018 etcdctl
-rwxr-xr-x  1 etcd etcd      876 Feb 17 23:30 etcd-server-startup.sh
-rw-r--r--  1 etcd etcd    32632 Oct 11  2018 README-etcdctl.md
-rw-r--r--  1 etcd etcd     5878 Oct 11  2018 README.md
-rw-r--r--  1 etcd etcd     7892 Oct 11  2018 READMEv2-etcdctl.md
[root@yn101-22 etcd]# chown -R etcd.etcd /data/etcd/
[root@yn101-22 etcd]# chown -R etcd.etcd /data/logs/etcd-server/
#安装管理后台进程软件,etcd后台启动如果进程掉了会自动启动
yum install supervisor -y
[root@yn101-22 etcd]# systemctl start supervisord
[root@yn101-22 etcd]# systemctl enable supervisord
Created symlink from /etc/systemd/system/multi-user.target.wants/supervisord.service to /usr/lib/systemd/system/supervisord.service.
#创建supervisor的启动文件
vi /etc/supervisord.d/etcd-server.ini
#内容如下
[program:etcd-server-101-22]
command=/opt/etcd/etcd-server-startup.sh
numprocs=1
directory=/opt/etcd
autostart=true
autorestart=true
startsecs=30
startretries=3
exitcodes=0,2
stopsignal=QUIT
stopwaitsecs=10
user=etcd
redirect_stderr=true
stdout_logfile=/data/logs/etcd-server/etcd.stdout.log
stdout_logfile_maxbytes=64MB
stdout_logfile_backups=4
stdout_capture_maxbytes=1MB
stdout_events_enabled=false
[root@yn101-22 etcd]# supervisorctl update
etcd-server-101-22: added process group
#查看启动状态
[root@yn101-22 etcd]# supervisorctl status
etcd-server-101-22               RUNNING   pid 11849, uptime 0:01:31
#查看启动日志
tail -fn 200 /data/logs/etcd-server/etcd.stdout.log
#为running状态,监听2379和2380端口才算启动成功
[root@yn101-22 etcd]# netstat -luntp | grep etcd
tcp        0      0 192.168.101.22:2379     0.0.0.0:*               LISTEN      11850/./etcd        
tcp        0      0 127.0.0.1:2379          0.0.0.0:*               LISTEN      11850/./etcd        
tcp        0      0 192.168.101.22:2380     0.0.0.0:*               LISTEN      11850/./etcd 

4、YN101-31.host.com安装etcd

cd /opt/src
tar xfv etcd-v3.1.20-linux-amd64.tar.gz -C /opt/
mv etcd-v3.1.20-linux-amd64/ etcd-v3.1.20
#软连接
ln -s /opt/etcd-v3.1.20/ /opt/etcd
#创建一个etcd的用户
useradd -s /sbin/nologin -M etcd
#创建目录,拷贝证书和私钥
mkdir -p /opt/etcd/certs /data/etcd /data/logs/etcd-server
scp yn101-100:/opt/certs/ca.pem .
scp yn101-100:/opt/certs/etcd-peer.pem .
scp yn101-100:/opt/certs/etcd-peer-key.pem .

创建etcd的启动脚本 vi /opt/etcd/etcd-server-startup.sh

#!/bin/sh
./etcd --name etcd-server-101-32         --data-dir /data/etcd/etcd-server         --listen-peer-urls https://192.168.101.32:2380         --listen-client-urls https://192.168.101.32:2379,http://127.0.0.1:2379         --quota-backend-bytes 8000000000         --initial-advertise-peer-urls https://192.168.101.32:2380         --advertise-client-urls https://192.168.101.32:2379,http://127.0.0.1:2379         --initial-cluster etcd-server-101-22=https://192.168.101.22:2380,etcd-server-101-31=https://192.168.101.31:2380,etcd-server-101-32=https://192.168.101.32:2380         --ca-file ./certs/ca.pem         --cert-file ./certs/etcd-peer.pem         --key-file ./certs/etcd-peer-key.pem         --client-cert-auth         --trusted-ca-file ./certs/ca.pem         --peer-ca-file ./certs/ca.pem         --peer-cert-file ./certs/etcd-peer.pem         --peer-key-file ./certs/etcd-peer-key.pem         --peer-client-cert-auth         --peer-trusted-ca-file ./certs/ca.pem         --log-output stdout
chmod +x etcd-server-startup.sh
#更改文件为etcd用户权限
chown -R etcd.etcd /opt/etcd-v3.1.20/
chown -R etcd.etcd /data/etcd/
chown -R etcd.etcd /data/logs/etcd-server/
#安装管理后台进程软件,etcd后台启动如果进程掉了会自动启动
yum install supervisor -y
[root@yn101-22 etcd]# systemctl start supervisord
[root@yn101-22 etcd]# systemctl enable supervisord
Created symlink from /etc/systemd/system/multi-user.target.wants/supervisord.service to /usr/lib/systemd/system/supervisord.service.
#创建supervisor的启动文件
vi /etc/supervisord.d/etcd-server.ini
#内容如下
[program:etcd-server-101-32]
command=/opt/etcd/etcd-server-startup.sh
numprocs=1
directory=/opt/etcd
autostart=true
autorestart=true
startsecs=30
startretries=3
exitcodes=0,2
stopsignal=QUIT
stopwaitsecs=10
user=etcd
redirect_stderr=true
stdout_logfile=/data/logs/etcd-server/etcd.stdout.log
stdout_logfile_maxbytes=64MB
stdout_logfile_backups=4
stdout_capture_maxbytes=1MB
stdout_events_enabled=false
[root@yn101-22 etcd]# supervisorctl update
etcd-server-101-22: added process group
#查看启动状态
[root@yn101-22 etcd]# supervisorctl status
etcd-server-101-22               RUNNING   pid 11849, uptime 0:01:31
#查看启动日志
tail -fn 200 /data/logs/etcd-server/etcd.stdout.log
#为running状态,监听2379和2380端口才算启动成功
[root@yn101-22 etcd]# netstat -luntp | grep etcd
tcp        0      0 192.168.101.22:2379     0.0.0.0:*               LISTEN      11850/./etcd        
tcp        0      0 127.0.0.1:2379          0.0.0.0:*               LISTEN      11850/./etcd        
tcp        0      0 192.168.101.22:2380     0.0.0.0:*               LISTEN      11850/./etcd 
#全部状态为running时,可在任意节点查看etcd健康状态
[root@yn101-22 etcd]# supervisorctl status
etcd-server-101-22               RUNNING   pid 11849, uptime 0:01:31
#健康状态监测
cd /opt/etcd
./etcdctl cluster-health

以上是关于部署etcd集群的主要内容,如果未能解决你的问题,请参考以下文章

kubernetes容器集群部署Etcd集群

k8s-外置ETCD集群部署

一键部署ETCD集群脚本

部署etcd集群

2etcd单机部署和集群部署

ETCD集群部署